CVE-2019-12400: Improper input validation in Apache Santuario XML Security for Java

org.apache.santuario:xmlsec Updated 02 Oct 2025

Summary

27/08/2019

Disclosed on

CVE-2019-12400

CVE

Yes i

Fix available

Moderate

Severity

5.5

CVSS Score

CVE-2019-12400: Improper input validation in Apache Santuario XML Security for Java. Affects org.apache.santuario:xmlsec versions >= 2.0.3, < 2.1.4. Fixed in 2.1.4. How to fix ↓

Also tracked for

libxml-security-java · Debian:11

The same CVE-2019-12400 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Santuario XML Security for Java is a library that provides functionality for XML digital signatures and encryption. It is commonly used in Java applications to secure XML documents and ensure their integrity and confidentiality. This vulnerability affects versions 2.0.3 and earlier of the library. The library introduced a caching mechanism to improve performance, but it did not properly validate input, allowing for potential security flaws when validating signed documents.

Vulnerability Detail

The vulnerability arises from the caching mechanism introduced in Apache Santuario XML Security for Java. If untrusted code registers a malicious implementation with the thread context class loader before Apache Santuario, this implementation can be cached and reused by the library. This can lead to security issues when validating signed documents, potentially compromising the integrity and confidentiality of the XML data. The vulnerability has a CVSS score of 5.5, indicating a moderate severity.

How To Fix

Minimum fixed version

2.1.4

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of the library to mitigate the risk.

Conclusion

The vulnerability in Apache Santuario XML Security for Java can lead to security flaws when validating signed documents. It is crucial to upgrade to the fixed version of the library (2.1.4 or later) to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for org.apache.santuario:xmlsec →